Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Opening VPN access

    Scheduled Pinned Locked Moved Firewalling
    15 Posts 3 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Looks like that should be all that's necessary there. Are there firewall rules on WAN passing the same traffic to 172.30.0.132? Is the traffic arriving at your Fortigate?

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • J
        Joeri Michiels
        last edited by

        We have indeed firewall rule on WAN passing the same traffic to 172.30.0.132.  (see screenshot - I'll attach a second screenshot in my next reply).

        ![2016-10-25 11_11_19-Settings.jpg](/public/imported_attachments/1/2016-10-25 11_11_19-Settings.jpg)
        ![2016-10-25 11_11_19-Settings.jpg_thumb](/public/imported_attachments/1/2016-10-25 11_11_19-Settings.jpg_thumb)

        1 Reply Last reply Reply Quote 0
        • J
          Joeri Michiels
          last edited by

          And the remaining rules in this second screenshot.  We also see traffic arriving at the Fortigate 200, (I believe this is the initial handshake of the communication) and then the connection gets drop before it is completely established.

          ![2016-10-25 11_12_01-Settings.jpg](/public/imported_attachments/1/2016-10-25 11_12_01-Settings.jpg)
          ![2016-10-25 11_12_01-Settings.jpg_thumb](/public/imported_attachments/1/2016-10-25 11_12_01-Settings.jpg_thumb)

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            NAT Traversal should be all you need. I don't think you can port-forward ESP itself.

            Is the traffic arriving on the fortigate?

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • J
              Joeri Michiels
              last edited by

              Yes.  Traffic is arriving at the fortigate.  In the logs we see the initial communication being setup, but then the connection attempt gets dropped, and I'm assuming that's because there is still something that is blocked.

              When I try to establish a vpn connection to the fortigate 200 directly via the local network, it works.  So I'm sure the fortigate is working.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Therefore it has to be pfSense at fault.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • J
                  Joeri Michiels
                  last edited by

                  I agree.  But how can I troubleshoot what's wrong ?

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Most likely problem: The Fortigate is sending it's local IP address as it's identifier and the device at the other end is expecting the pfSense WAN IP.

                    Check the expected identifier at the other end. Change the Fortigate to send the public IP if that's what is needed to match.

                    Or you could just use pfSense to setup the tunnel directly.  ;)

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • J
                      Joeri Michiels
                      last edited by

                      According to Fortigate that is likely the cause of the problem.  Could you send me the instructions on how to change the configuration to send down the local identifier to the device ? Thanks.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        That's something you would need to configure in the Fortigate. I can't help you with that.

                        Is there a reason you're not just terminating the VPN in pfSense directly? I could help you with that.  ;)

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.